Professional services · Internal knowledge copilot
Proving an internal copilot respects the permissions its documents already had.
A professional-services firm with offices in several countries was rolling a knowledge copilot out to more than ten thousand staff. It drew on document stores, email and the HR system. Leadership wanted one thing settled before the firm-wide launch: that it would never show someone a document they could not already open.
Sector
Professional services
System
Retrieval-backed internal copilot across document, email and HR sources
Engagement
AI Security Assessment
Timeline
Five-week engagement; continuous assurance since
The situation
Ten thousand people, one assistant, every document.
The pilot had gone well. Partners liked it, the analysts who built it were proud of it, and the connectors to the firm's document platform, mailboxes and HR records were in place. The sources were sensitive by nature: client matters, deal rooms, performance reviews, compensation.
The firm's own review had focused on the model and the prompts. The question nobody had answered end to end was simpler and harder: when the copilot retrieves, does it retrieve as the user, or as itself? We were asked to answer it with evidence, across every connector.
What we found
It retrieved as itself, not as the user.
Two connectors retrieved with a service identity
The document and HR connectors indexed content using a privileged account. The copilot then filtered results by the user's permissions - after retrieval, in application code. Three gaps in that filter returned excerpts of files the user could not open directly.
Summaries leaked what the full document would not
Even where a document was correctly withheld, the copilot had already summarised it into its working context. Asking about the topic rather than the file produced the substance.
Shared mailboxes blurred the boundary
Mailbox access was scoped per user, but a shared team mailbox was indexed for everyone with any membership, past or present.
Compensation data was one question away
HR records were in scope for managers. The copilot could be led to aggregate across reports a manager should not have been able to see together.
What changed
Permissions enforced before the model sees a word.
The fix was structural rather than cosmetic: retrieval now happens as the user, on every source, and the firm-wide launch went ahead on the planned date with the findings closed and evidenced.
- Retrieval moved to the user's own identity on every connector - no privileged indexing, no post-hoc filtering
- Permission checks enforced before content enters the model's context, not after
- Shared mailboxes scoped to current membership and re-evaluated on every query
- HR records removed from the general copilot; a separately governed HR assistant scoped afterwards
- An access-control test set, mapped to real permission scenarios, for the firm to run on every change
Ongoing assurance
New sources are tested before staff see them.
Connectors are where this system changes most. Each new source, platform upgrade or permission-model change runs through the access-control suite before it goes live. We added the firm's new matter-management platform to the suite this year and found a filter regression in a connector update before it reached staff.
The firm's security team owns the suite day to day. We review coverage with them twice a year and test new sources on request.
How continuous assurance worksMore case studies
All case studiesBegin with evidence